[int]

Mobile because I'd rather have my two devices stay separated. Just in case of unauthorized entry.

this, someone rdp's into your computer and everything is gg

[Disease]

I'm in the mobile-only camp on this one. Separation of concerns.

On all of my devices (desktops, laptops, and phones), I use LastPass to manage my passwords. No two accounts of mine use the same password- ever. And all passwords are 20+ random alphanumerical and special characters, unless a website restricts maximum length (in which case, it'll be maximum length). Because the password manager creates and stores these passwords, and facilitates filling them in (or at least copying them to clipboard upon request), I never need to fill out a password. Thus someone logging everything I type will never see even a username, let alone a password.

LastPass, and many other accounts, are also set up with Multi-Factor Authentication. Run off of my phone, never off of my desktop. Compromise my PC, fine. I'll recover that. But unless you can also compromise my mobile device (because you're never going to get me to fall for providing you an authentication code), you're SOL.

At best, you'll get my LastPass password, as I do have to type that in. But again, I have MFA enabled, so good luck getting anything out of that. And, as it's a unique password, it's useless for any other accounts I may have.

[Unexplained]

Mobile because I'd rather have my two devices stay separated. Just in case of unauthorized entry.

This.

I feel if your system has any unauthorized access, the shit is sitting right. All your "keys" to your personal stuff is too easily accessible.

Keep that shit separate and on your mobile device.

---

I'm in the mobile-only camp on this one.  Separation of concerns.

On all of my devices (desktops, laptops, and phones), I use LastPass to manage my passwords.  No two accounts of mine use the same password- ever.  And all passwords are 20+ random alphanumerical and special characters, unless a website restricts maximum length (in which case, it'll be maximum length).  Because the password manager creates and stores these passwords, and facilitates filling them in (or at least copying them to clipboard upon request), I never need to fill out a password.  Thus someone logging everything I type will never see even a username, let alone a password.

LastPass, and many other accounts, are also set up with Multi-Factor Authentication.  Run off of my phone, never off of my desktop.  Compromise my PC, fine.  I'll recover that.  But unless you can also compromise my mobile device (because you're never going to get me to fall for providing you an authentication code), you're SOL.

At best, you'll get my LastPass password, as I do have to type that in.  But again, I have MFA enabled, so good luck getting anything out of that.  And, as it's a unique password, it's useless for any other accounts I may have.

I have yet to dive into something like LastPass. Do you feel its security is good?
I've had people I talked with that have had their shit compromised through one of those password vault services.

[Disease]

This.

I feel if your system has any unauthorized access, the shit is sitting right. All your "keys" to your personal stuff is too easily accessible.

Keep that shit separate and on your mobile device.

---

I have yet to dive into something like LastPass. Do you feel its security is good?
I've had people I talked with that have had their shit compromised through one of those password vault services.

LastPass is very open about the fact that they did, once, experience a security breach. It was fairly well contained, though. In fact, no password data was compromised. And their response to it has only instilled, in me, more confidence in them than ever. They are also very transparent (well, as transparent as can be) with their security model. You can read it about it yourself, and make a judgement call. In short, with their model, your data is (relatively) safe, even if their database was exposed and dumped. That's due to attackers requiring more than just the data... they need account-level authentication and encryption keys to have a hope's chance at working with the data.

In my opinion- LastPass is exponentially more secure then the common alternatives: storing passwords locally, or only using a small set of passwords across all of your accounts. In fact, I'd go as far as to say it is infinitely more secure than the latter, as that's simply the utter absence of security (and 1 is infinitely more than 0). Unfortunately, the latter is what most people will do. Even here on HF... I did a thread not that long ago, asking about this. And the number of individuals here, at HackForums, that embody the utmost deplorable security practices is astonishing. I'd have thought more people here would be wise to such elementary issues. But alas, ignorance knows no bounds!

[Unexplained]

LastPass is very open about the fact that they did, once, experience a security breach.  It was fairly well contained, though.  In fact, no password data was compromised.  And their response to it has only instilled, in me, more confidence in them than ever. They are also very transparent (well, as transparent as can be) with their security model.  You can read it about it yourself, and make a judgement call.  In short, with their model, your data is (relatively) safe, even if their database was exposed and dumped.  That's due to attackers requiring more than just the data... they need account-level authentication and encryption keys to have a hope's chance at working with the data.

In my opinion- LastPass is exponentially more secure then the common alternatives: storing passwords locally, or only using a small set of passwords across all of your accounts.  In fact, I'd go as far as to say it is infinitely more secure than the latter, as that's simply the utter absence of security (and 1 is infinitely more than 0).  Unfortunately, the latter is what most people will do.  Even here on HF... I did a thread not that long ago, asking about this.  And the number of individuals here, at HackForums, that embody the utmost deplorable security practices is astonishing.  I'd have thought more people here would be wise to such elementary issues.  But alas, ignorance knows no bounds!

Ignorance is bliss, lol...

I appreciate the feedback. I was checking out their services and they have premium stuff, like $3/mo. Are you using the free version and happy with it?

[Disease]

Ignorance is bliss, lol...

I appreciate the feedback. I was checking out their services and they have premium stuff, like $3/mo. Are you using the free version and happy with it?

You’ll be fine with their free platform. I generally upgrade everything I use. But I actually use the free tier of LastPass. Even with it being one of my most valued tools. The premium tier just doesn’t provide anything that is a must-have in my opinion. The free tier is full-featured.

[ShinyThings]

If you're going to run it on a VM sure... Desktop would probably be easy to use but your phone is probably the safest way.